[rubendev]

This is really a self inflicted problem. If you host your backend on the same origin as your frontend (using a reverse proxy) you don’t need CORS at all and you can use the vanilla SOP, and strengthen it further with a strict CSP.

[ricardobeat]

It really is architecture dependent. There are many valid reasons why would not want to route all API requests through your frontend infra, or vice-versa.